Bug 1439797 - Enable reporting-only CSP by default

5 files changed, 36 insertions, 23 deletions

diff --git a/template/en/default/reports/create-chart.html.tmpl b/template/en/default/reports/create-chart.html.tmpl
index 1e6945ebc..e20d8522f 100644
--- a/template/en/default/reports/create-chart.html.tmpl
+++ b/template/en/default/reports/create-chart.html.tmpl
@@ -33,7 +33,7 @@
   donames = 1 
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 [%# This function takes necessary action on selection of a subcategory %]
 function subcatSelected() {
   var cat = document.chartform.category.value;
@@ -55,6 +55,15 @@ function subcatSelected() {
   
   checkNewState();
 }
+document.addEventListener("DOMContentLoaded", function(event) {
+  document.chartform.category.addEventListener("change", function (event) {
+    catSelected();
+    return subcatSelected();
+  });
+  document.chartform.subcategory.addEventListener("change", function (event) {
+    return subcatSelected();
+  });
+});
 </script>
   
 [% gttext = "Grand Total" %]
@@ -79,23 +88,20 @@ function subcatSelected() {
         </th>
       </tr>
       <tr>
-      
-        [% PROCESS series_select sel = { name => 'category', 
-                                         size => 5,
-                                         onchange = "catSelected();
-                                                     subcatSelected();" } %]
-                                   
+
+        [% PROCESS series_select sel = { name => 'category',
+                                         size => 5 } %]
+
         <td>
           <noscript>
             <input type="submit" name="action-assemble" value="Update --&gt;"
                    id="action-assemble">
           </noscript>
         </td>
-        
-        [% PROCESS series_select sel = { name => 'subcategory', 
-                                         size => 5,
-                                         onchange = "subcatSelected()" } %]
-                                   
+
+        [% PROCESS series_select sel = { name => 'subcategory',
+                                         size => 5 } %]
+
         <td>
           <noscript>
             <input type="submit" name="action-assemble" value="Update --&gt;"
diff --git a/template/en/default/reports/keywords.html.tmpl b/template/en/default/reports/keywords.html.tmpl
index 97a2d44d2..491bac78e 100644
--- a/template/en/default/reports/keywords.html.tmpl
+++ b/template/en/default/reports/keywords.html.tmpl
@@ -34,7 +34,7 @@
   title = "$terms.Bugzilla Keyword Descriptions"
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
  $(document).ready(function () {
      var show_inactive_keywords = [% show_inactive_keywords ? "true" : "false" FILTER none %],
          link = $("#keywords_show_hide"),
diff --git a/template/en/default/reports/report-table.html.tmpl b/template/en/default/reports/report-table.html.tmpl
index e8f926f64..096eb171a 100644
--- a/template/en/default/reports/report-table.html.tmpl
+++ b/template/en/default/reports/report-table.html.tmpl
@@ -46,7 +46,7 @@
   [% urlbase = BLOCK %][% urlbase %]&amp;[% tbl_field FILTER uri %]=[% tbl FILTER uri %][% END %]
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 function bz_encode (str, decode) {
   // First decode HTML entities, if requested.
   if (decode)
diff --git a/template/en/default/reports/series-common.html.tmpl b/template/en/default/reports/series-common.html.tmpl
index 469eb79c5..b8032255d 100644
--- a/template/en/default/reports/series-common.html.tmpl
+++ b/template/en/default/reports/series-common.html.tmpl
@@ -29,7 +29,7 @@
 [% subcategory = category.${default.category} %]
 [% name = subcategory.${default.subcategory} %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 [%# This structure holds details of the series the user can select from. %]
 var series = {
 [% FOREACH c = category.keys.sort %]
diff --git a/template/en/default/reports/series.html.tmpl b/template/en/default/reports/series.html.tmpl
index 3cf939003..164c30355 100644
--- a/template/en/default/reports/series.html.tmpl
+++ b/template/en/default/reports/series.html.tmpl
@@ -29,7 +29,16 @@
 [% PROCESS "reports/series-common.html.tmpl"
    newtext = "New (name below)" 
  %]
-  
+
+<script [% script_nonce FILTER none %]>
+  document.addEventListener("DOMContentLoaded", function (event) {
+    if (document.chartform) {
+      document.chartform.category.addEventListener("change", (event) => catSelected());
+      document.chartform.subcategory.addEventListener("change", (event) => checkNewState());
+    }
+  });
+</script>
+
 <table cellpadding="2" cellspacing="2" border="0"
        style="text-align: left; margin-left: 20px">
   <tbody>
@@ -42,19 +51,17 @@
     </tr>
     <tr>
       [% PROCESS series_select sel = { name => 'category',
-                                       size => 5,
-                                       onchange => "catSelected()" } %]
+                                       size => 5 } %]
         <td>
           <noscript>
             <input type="submit" name="action-edit" value="Update --&gt;"
                    id="action-edit">
           </noscript>
         </td>
-        
-      [% PROCESS series_select sel = { name => 'subcategory', 
-                                       size => 5,
-                                       onchange => "checkNewState()" } %]
-        
+
+      [% PROCESS series_select sel = { name => 'subcategory',
+                                       size => 5 } %]
+
       <td valign="top" name="name">
         <input type="text" name="name" maxlength="64" 
                value="[% default.name.0 FILTER html %]" size="25">